@@ -9,6 +9,12 @@ on:
     merge_group:
         types: [checks_requested]
 
+# Cancel superseded runs when a pull request is updated. Non-PR events keep
+# unique groups, so main, merge-queue, and manual runs are never cancelled.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 # Least privilege: every job below escalates only where it needs to.
 permissions:
     contents: read
 
@@ -7,6 +7,12 @@ on:
     schedule:
         - cron: "24 19 * * 3"
 
+# Cancel superseded runs when a pull request is updated. Non-PR events keep
+# unique groups, so main pushes and scheduled scans are never cancelled.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 # Least privilege: the analyze job escalates to security-events: write via its
 # own job-level permissions block.
 permissions:
 
@@ -7,6 +7,12 @@ on:
     merge_group:
         types: [checks_requested]
 
+# Cancel superseded runs when a pull request is updated. Non-PR events keep
+# unique groups, so merge-queue and manual runs are never cancelled.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
     contents: read
 
 
@@ -16,6 +16,12 @@ on:
             - "releases/**"
             - ".github/workflows/release-validation.yml"
 
+# Cancel superseded runs when a pull request is updated. Non-PR events keep
+# unique groups, so manual runs are never cancelled.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
     contents: read